AD CS ESC7: Dangerous Permissions on a Certificate Authority

ESC7 is excessive Manage CA or Manage Certificates permission on an AD CS certification authority. Manage CA can change CA configuration, publish templates, and assign CA roles; Manage Certificates can approve or deny pending requests and revoke issued certificates. A documented chain uses Manage CA to publish SubCA and, when needed, assign the operator Certificate Officer rights; it submits a privileged certificate request, approves the pending request, retrieves the issued certificate, and attempts certificate-based authentication. Manage Certificates alone generally requires an already-pending privileged request. The CA must be trusted for domain authentication. On Windows domain controllers with the September 9, 2025 update or later, compatibility-mode fallback is unsupported and strong certificate mapping is required; a SAN UPN or SAN SID alone does not override a missing or mismatched SID security extension or another required strong mapping.